List json parsing

[E.Eric (Eric)]

Hello,

I have a probleme to create a list of json object. this is my config:
input {
file {#settings...}
}
filter {
mutate {
add_field => {"book_title" => "%{Book_title}"}
add_field => {"book_price" => "%{Book_price}"}}
mutate {
rename => { "book_title" => "[book_market][book_title]"
"book_price" => "[book_market][book_price]" }
}
#I want book_market be list for some reason even it has one object
ruby {
code => "
event['book_market'] = [event['book_market']]
"
}
}
the result here after execution:
"book_market" : [ {
"book_title":"title",
"book_price":"price"
}]
it's that I want !
But in a second time a new book arrives from another file... the probleme here with the same config I lost the first json object because book_market is overwritten.. I want to insert the new object in book_market list.

Thank you for help !

[magnusbaeck (Magnus Bäck)]

Do you want to update existing documents in ES? Then you need use scripted updates, which seems to be possible with the elasticsearch output but I've never tried it myself.

[E.Eric (Eric)]

Yes, I want to update existing document in ES.
I create a new configuration for update, I've extracted book information from input file and then I tryed to update th document in ES. This is my config:

output { 

   elasticsearch {
        hosts => ["172.16.25.9:9200"]
        index => "shopping"
        document_type => "book"
        action => "update"          
        #indicate the document ID to be updated
        document_id => "%{book_id}"
        #Enable Partial Update in ElasticSearch
        doc_as_upsert => true
        script_lang => "groovy"
        script_type => "inline"
        script => '
                ctx._source.book_market.add("%{book_title}" "%{book_price}");
            '
    }

"error"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to execute script", "caused_by"=>{"type"=>"script_exception", "reason"=>"failed to run inline script [\n\t\t\t\t\tctx._source.book_market..add("%{book_title}" "%{book_price}");"] using lang [groovy]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"argument type mismatch"}}}}}, :level=>:warn}